github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-16 21:00:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/drivers/net/can/dev
History
zjamg 0a04c0cb86 can: dev: init_can_skb(): restore skb header initialization 
Commit 9f10374bb0 ("can: remove private CAN skb headroom infrastructure")
removed the skb_reset_mac_header()/skb_reset_network_header()/
skb_reset_transport_header() calls from init_can_skb(). As a result, RX
skbs from alloc_can_skb() and friends again carry mac_header = 0xFFFF.
When such an skb reaches packet_rcv_spkt() (SOCK_PACKET), the push length
calculation overflows and triggers skb_under_panic -> kernel BUG -> full
machine panic.

The same issue was originally reported in 2014 on linux-can and fixed by
commit 969439016d ("can: add missing initialisations in CAN related
skbuffs"). packet_rcv_spkt() itself has never been hardened: only
packet_rcv() and tpacket_rcv() gained dev_has_header() checks in
commit d549699048 ("net/packet: fix packet receive on L3 devices
without visible hard header").

Fixes: 9f10374bb0 ("can: remove private CAN skb headroom infrastructure")
Cc: stable@vger.kernel.org
Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: zjamg <ndaugoing@gmail.com>
Tested-by: Quchaosheng <quchaosheng000406@163.com>
Link: https://patch.msgid.link/20260917123716.63116-1-ndaugoing@gmail.com
Reported-by: Shaunak Datar <shaunakkdatar@gmail.com>
Closes: https://lore.kernel.org/all/20260918151606.765490-1-shaunakkdatar@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-10-01 17:05:03 +02:00
..
bittiming.c can: bittiming: add PWM validation 2025-11-26 11:20:43 +01:00
calc_bittiming.c can: dev: keep the max bitrate error at 5% 2026-03-10 11:12:52 +01:00
dev.c can: dev: alloc_candev_mqs(): add missing default CAN capabilities 2026-01-16 18:06:56 +01:00
length.c can: length: refactor frame lengths definition to add size in bits 2023-06-22 09:43:40 +02:00
Makefile Revert "can: raw: instantly reject unsupported CAN frames" 2026-01-15 09:52:04 +01:00
netlink.c can: netlink: can_changelink(): add missing error handling to call can_ctrlmode_changelink() 2026-03-19 14:25:04 +01:00
rx-offload.c netdev: replace napi_reschedule with napi_schedule 2023-10-11 17:28:06 -07:00
skb.c can: dev: init_can_skb(): restore skb header initialization 2026-10-01 17:05:03 +02:00